CVE-2025-39798

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39798", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.133Z", "datePublished": "2025-09-12T15:59:34.386Z", "dateUpdated": "2026-10-15T22:02:32.213Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:15.150Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix the setting of capabilities when automounting a new filesystem\n\nCapabilities cannot be inherited when we cross into a new filesystem.\nThey need to be reset to the minimal defaults, and then probed for\nagain."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable state is produced while the NFS client processes a remote server's export topology and SERVER_CAPS/FSINFO replies when crossing a server-side mountpoint or following an NFSv4 referral. A malicious/compromised NFS server, or an attacker MITM'ing the common unauthenticated AUTH_SYS NFS connection, controls every input needed to trigger the mismatch.\nAC:L - The attacker-controlled server simply exports a nested filesystem (distinct FSID) or referral whose capability set differs from the parent's; the stale-capability inheritance then occurs deterministically on every crossing. No race, timing, or memory-layout condition is involved.\nPR:N - No credentials or privileges on the client are needed \u2014 the malicious data comes from the remote server side, and the automount is performed by the client kernel during ordinary path traversal. Local reachability likewise requires only an unprivileged user walking into the mountpoint.\nUI:N - Automount is by definition transparent: any process, including background daemons, indexers or backup jobs, that traverses into the server-side mountpoint triggers nfs_d_automount() and the faulty clone. No distinct victim action beyond normal use of an already-mounted share is required.\nS:U - The incorrect capability state stays within the NFS client's own security authority in the client kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:L - Stale NFS_CAP_UIDGID_NOMAP causes the client to encode/interpret owner and group identities as raw numeric IDs on a filesystem that expects idmapped names, so files can be attributed to the wrong principal and exposed to the wrong local user; this is limited, bounded metadata exposure rather than arbitrary kernel memory disclosure.\nI:L - The same stale identity-mapping state means creates/chowns on the automounted filesystem can land under an incorrect owner, and inherited NFS_CAP_DELEGTIME makes the client locally manage timestamps against a server that never granted delegated timestamps. This is limited metadata/ownership corruption, not an arbitrary write or control-flow hijack.\nA:L - Inherited NFS_CAP_FS_LOCATIONS with trunking discovery makes nfs_probe_fsinfo() fail and aborts the automount, and inherited NFS_CAP_OPEN_XOR/XATTR cause OPEN and xattr operations to be rejected with NFS4ERR_NOTSUPP, rendering the crossed subtree unusable. There is no kernel crash, hang, or panic, so the loss of availability is confined to the affected mount."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/client.c", "fs/nfs/internal.h", "fs/nfs/nfs4client.c", "fs/nfs/nfs4proc.c"], "versions": [{"version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "95eb0d97ab98a10e966125c1f274e7d0fc0992b3", "status": "affected", "versionType": "git"}, {"version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "73fcb101bb3eb2a552d7856a476b2c0bc3b5ef9e", "status": "affected", "versionType": "git"}, {"version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "3924dab90816d0c683a110628ef386f83a9d1e13", "status": "affected", "versionType": "git"}, {"version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "175afda783e38c0660f2afc0602dd9c83d4e7ee1", "status": "affected", "versionType": "git"}, {"version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "987c20428f067c1c7f29ed0a2bd8c63fa74b1c2c", "status": "affected", "versionType": "git"}, {"version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "816a6f60c2c2b679a33fa4276442bafd11473651", "status": "affected", "versionType": "git"}, {"version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "a8ffee4abd8ec9d7a64d394e0306ae64ba139fd2", "status": "affected", "versionType": "git"}, {"version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "50e0fd0050e510e749e1fdd1d7158e419ff8f3b9", "status": "affected", "versionType": "git"}, {"version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "b01f21cacde9f2878492cf318fee61bf4ccad323", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nfs/client.c", "fs/nfs/internal.h", "fs/nfs/nfs4client.c", "fs/nfs/nfs4proc.c"], "versions": [{"version": "2.6.19", "status": "affected"}, {"version": "0", "lessThan": "2.6.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.297", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.241", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.190", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.149", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.103", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.43", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15.11", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.2", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "5.4.297"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "5.10.241"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "5.15.190"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.1.149"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.6.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.12.43"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.15.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.16.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/95eb0d97ab98a10e966125c1f274e7d0fc0992b3"}, {"url": "https://git.kernel.org/stable/c/73fcb101bb3eb2a552d7856a476b2c0bc3b5ef9e"}, {"url": "https://git.kernel.org/stable/c/3924dab90816d0c683a110628ef386f83a9d1e13"}, {"url": "https://git.kernel.org/stable/c/175afda783e38c0660f2afc0602dd9c83d4e7ee1"}, {"url": "https://git.kernel.org/stable/c/987c20428f067c1c7f29ed0a2bd8c63fa74b1c2c"}, {"url": "https://git.kernel.org/stable/c/816a6f60c2c2b679a33fa4276442bafd11473651"}, {"url": "https://git.kernel.org/stable/c/a8ffee4abd8ec9d7a64d394e0306ae64ba139fd2"}, {"url": "https://git.kernel.org/stable/c/50e0fd0050e510e749e1fdd1d7158e419ff8f3b9"}, {"url": "https://git.kernel.org/stable/c/b01f21cacde9f2878492cf318fee61bf4ccad323"}], "title": "NFS: Fix the setting of capabilities when automounting a new filesystem", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:43:29.893Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:08:24.258Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-39798", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:54:18.287763Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:32.213Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:43:29.893Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.5", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:08:24.258Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-39798", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:54:18.287763Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:54:18.898Z"}}], "cna": {"title": "NFS: Fix the setting of capabilities when automounting a new filesystem", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable state is produced while the NFS client processes a remote server's export topology and SERVER_CAPS/FSINFO replies when crossing a server-side mountpoint or following an NFSv4 referral. A malicious/compromised NFS server, or an attacker MITM'ing the common unauthenticated AUTH_SYS NFS connection, controls every input needed to trigger the mismatch.\nAC:L - The attacker-controlled server simply exports a nested filesystem (distinct FSID) or referral whose capability set differs from the parent's; the stale-capability inheritance then occurs deterministically on every crossing. No race, timing, or memory-layout condition is involved.\nPR:N - No credentials or privileges on the client are needed \u2014 the malicious data comes from the remote server side, and the automount is performed by the client kernel during ordinary path traversal. Local reachability likewise requires only an unprivileged user walking into the mountpoint.\nUI:N - Automount is by definition transparent: any process, including background daemons, indexers or backup jobs, that traverses into the server-side mountpoint triggers nfs_d_automount() and the faulty clone. No distinct victim action beyond normal use of an already-mounted share is required.\nS:U - The incorrect capability state stays within the NFS client's own security authority in the client kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:L - Stale NFS_CAP_UIDGID_NOMAP causes the client to encode/interpret owner and group identities as raw numeric IDs on a filesystem that expects idmapped names, so files can be attributed to the wrong principal and exposed to the wrong local user; this is limited, bounded metadata exposure rather than arbitrary kernel memory disclosure.\nI:L - The same stale identity-mapping state means creates/chowns on the automounted filesystem can land under an incorrect owner, and inherited NFS_CAP_DELEGTIME makes the client locally manage timestamps against a server that never granted delegated timestamps. This is limited metadata/ownership corruption, not an arbitrary write or control-flow hijack.\nA:L - Inherited NFS_CAP_FS_LOCATIONS with trunking discovery makes nfs_probe_fsinfo() fail and aborts the automount, and inherited NFS_CAP_OPEN_XOR/XATTR cause OPEN and xattr operations to be rejected with NFS4ERR_NOTSUPP, rendering the crossed subtree unusable. There is no kernel crash, hang, or panic, so the loss of availability is confined to the affected mount."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "95eb0d97ab98a10e966125c1f274e7d0fc0992b3", "versionType": "git"}, {"status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "73fcb101bb3eb2a552d7856a476b2c0bc3b5ef9e", "versionType": "git"}, {"status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "3924dab90816d0c683a110628ef386f83a9d1e13", "versionType": "git"}, {"status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "175afda783e38c0660f2afc0602dd9c83d4e7ee1", "versionType": "git"}, {"status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "987c20428f067c1c7f29ed0a2bd8c63fa74b1c2c", "versionType": "git"}, {"status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "816a6f60c2c2b679a33fa4276442bafd11473651", "versionType": "git"}, {"status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "a8ffee4abd8ec9d7a64d394e0306ae64ba139fd2", "versionType": "git"}, {"status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "50e0fd0050e510e749e1fdd1d7158e419ff8f3b9", "versionType": "git"}, {"status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "lessThan": "b01f21cacde9f2878492cf318fee61bf4ccad323", "versionType": "git"}], "programFiles": ["fs/nfs/client.c", "fs/nfs/internal.h", "fs/nfs/nfs4client.c", "fs/nfs/nfs4proc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.19"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.19", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.297", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.241", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.190", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.149", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.103", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.43", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.11", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16.2", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/nfs/client.c", "fs/nfs/internal.h", "fs/nfs/nfs4client.c", "fs/nfs/nfs4proc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/95eb0d97ab98a10e966125c1f274e7d0fc0992b3"}, {"url": "https://git.kernel.org/stable/c/73fcb101bb3eb2a552d7856a476b2c0bc3b5ef9e"}, {"url": "https://git.kernel.org/stable/c/3924dab90816d0c683a110628ef386f83a9d1e13"}, {"url": "https://git.kernel.org/stable/c/175afda783e38c0660f2afc0602dd9c83d4e7ee1"}, {"url": "https://git.kernel.org/stable/c/987c20428f067c1c7f29ed0a2bd8c63fa74b1c2c"}, {"url": "https://git.kernel.org/stable/c/816a6f60c2c2b679a33fa4276442bafd11473651"}, {"url": "https://git.kernel.org/stable/c/a8ffee4abd8ec9d7a64d394e0306ae64ba139fd2"}, {"url": "https://git.kernel.org/stable/c/50e0fd0050e510e749e1fdd1d7158e419ff8f3b9"}, {"url": "https://git.kernel.org/stable/c/b01f21cacde9f2878492cf318fee61bf4ccad323"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix the setting of capabilities when automounting a new filesystem\n\nCapabilities cannot be inherited when we cross into a new filesystem.\nThey need to be reset to the minimal defaults, and then probed for\nagain."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.297", "versionStartIncluding": "2.6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.241", "versionStartIncluding": "2.6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.190", "versionStartIncluding": "2.6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.149", "versionStartIncluding": "2.6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.103", "versionStartIncluding": "2.6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.43", "versionStartIncluding": "2.6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15.11", "versionStartIncluding": "2.6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16.2", "versionStartIncluding": "2.6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17", "versionStartIncluding": "2.6.19"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:15.150Z"}}}, "cveMetadata": {"cveId": "CVE-2025-39798", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:32.213Z", "dateReserved": "2025-04-16T07:20:57.133Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-09-12T15:59:34.386Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/nfs/client.c", "fs/nfs/internal.h", "fs/nfs/nfs4client.c", "fs/nfs/nfs4proc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "95eb0d97ab98a10e966125c1f274e7d0fc0992b3", "status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "versionType": "git"}, {"lessThan": "73fcb101bb3eb2a552d7856a476b2c0bc3b5ef9e", "status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "versionType": "git"}, {"lessThan": "3924dab90816d0c683a110628ef386f83a9d1e13", "status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "versionType": "git"}, {"lessThan": "175afda783e38c0660f2afc0602dd9c83d4e7ee1", "status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "versionType": "git"}, {"lessThan": "987c20428f067c1c7f29ed0a2bd8c63fa74b1c2c", "status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "versionType": "git"}, {"lessThan": "816a6f60c2c2b679a33fa4276442bafd11473651", "status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "versionType": "git"}, {"lessThan": "a8ffee4abd8ec9d7a64d394e0306ae64ba139fd2", "status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "versionType": "git"}, {"lessThan": "50e0fd0050e510e749e1fdd1d7158e419ff8f3b9", "status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "versionType": "git"}, {"lessThan": "b01f21cacde9f2878492cf318fee61bf4ccad323", "status": "affected", "version": "54ceac4515986030c2502960be620198dd8fe25b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/nfs/client.c", "fs/nfs/internal.h", "fs/nfs/nfs4client.c", "fs/nfs/nfs4proc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.19"}, {"lessThan": "2.6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.297", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.241", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.190", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.149", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.103", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.43", "versionType": "semver"}, {"lessThanOrEqual": "6.15.*", "status": "unaffected", "version": "6.15.11", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC CN 4100", "vendor": "Siemens", "versions": [{"lessThan": "V5.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.5", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0706A31F-1839-40E9-B535-49B47368E988", "versionEndExcluding": "5.4.297", "versionStartIncluding": "2.6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0D21C35-EB8A-488A-BBF9-403E4817E5DD", "versionEndExcluding": "5.10.241", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD9E597F-3DDE-4D7E-976C-463D0611F13F", "versionEndExcluding": "5.15.190", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FDBE8280-8983-4D2D-943D-2E6D0104E2D8", "versionEndExcluding": "6.1.149", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F2293654-7169-49B5-8D0D-EE51EF8B8E48", "versionEndExcluding": "6.6.103", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "472C5F87-2BF3-4FAB-9B21-DA7513977363", "versionEndExcluding": "6.12.43", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC242347-F722-43AE-B910-BE0B22386977", "versionEndExcluding": "6.15.11", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD7C087D-2415-4521-B624-30003352F899", "versionEndExcluding": "6.16.2", "versionStartIncluding": "6.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNFS: Fix the setting of capabilities when automounting a new filesystem\n\nCapabilities cannot be inherited when we cross into a new filesystem.\nThey need to be reset to the minimal defaults, and then probed for\nagain."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nNFS: Corrige la configuraci\u00f3n de las capacidades al automontar un nuevo sistema de archivos\n\nLas capacidades no pueden ser heredadas cuando cruzamos a un nuevo sistema de archivos. Necesitan ser restablecidas a los valores predeterminados m\u00ednimos, y luego ser sondeadas de nuevo."}], "id": "CVE-2025-39798", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-39798", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:54:18.287763Z", "version": "2.0.3"}}]}, "published": "2025-09-12T16:15:34.267", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/175afda783e38c0660f2afc0602dd9c83d4e7ee1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3924dab90816d0c683a110628ef386f83a9d1e13"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/50e0fd0050e510e749e1fdd1d7158e419ff8f3b9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/73fcb101bb3eb2a552d7856a476b2c0bc3b5ef9e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/816a6f60c2c2b679a33fa4276442bafd11473651"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/95eb0d97ab98a10e966125c1f274e7d0fc0992b3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/987c20428f067c1c7f29ed0a2bd8c63fa74b1c2c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a8ffee4abd8ec9d7a64d394e0306ae64ba139fd2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b01f21cacde9f2878492cf318fee61bf4ccad323"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: NFS: Fix the setting of capabilities when automounting a new filesystem", "id": "2400062", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2400062"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nNFS: Fix the setting of capabilities when automounting a new filesystem\nCapabilities cannot be inherited when we cross into a new filesystem.\nThey need to be reset to the minimal defaults, and then probed for\nagain."], "name": "CVE-2025-39798", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-09-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39798\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39798\nhttps://lore.kernel.org/linux-cve-announce/2025091224-CVE-2025-39798-a66e@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-09-15T10:43:45.471666+00:00", "updated": "2025-09-15T10:43:45.471714+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}